A utility that digs through DNS domain records to find things that aren't obvious, such as subdomains, hostnames with more than one kind of record associated with them, and IP address range calculation. It even Google scrapes to gather intelligence.